AutoUpdate not working in 4.1 Device Mgr

[john.winter]

I can't seem to update the signature using Autoupdate. It works manually. I'm using MS Windows 2000 FTP server and the userid has full permissions to the folder/file.

Can anyone help tell me what I'm missing?

[jamesand]

If a manual update works then it is probably the autoupdate "directory" entry. Try manually logging into the ftp server. Then change directories to the same string that is used in the autoupdate "directory" entry. For example: "cd my_update_dir". If your update package(s) are in the ftp server home directoy then you can just use "." as the directory.

[john.winter]

still doesn't work. I've tried a dot, a /directoryname/, /directoryname, directoryname, all don't work. I've quadruplechecked my credentials. Nothing works. Is there any logs/debug that can tell me why this isn't working? Anyone have any idea where I can go next? This is so frustrating.

[marcabal]

If you are using a Windows FTP server, then a likely issue is the format of the directory listing.

The sensor needs the listing in a standard Unix format, but most windoes FTP servers will default to using a Windows/DOS format listing.

This doesn't affect manual upgrades, but will affect automatic upgrades.

Check your FTP server configuration and change it to use Unix formatted directory listings (most ftp servers on windows will have this option).

The other things to try:

Create a service account on the sensor.

Login as the service account.

Just before the scheduled automatic update time execute the following command:

tcpdump -i eth0 -s 1600 -w ./ftppackets.pcap host 10.1.1.1

Replace eth0 with the specific command and control interface of your sensor (use ifconfig -a and look for the interface with the IP address assigned to it).

Also replace 10.1.1.1 with the address of your ftp server.

Now wait until the auto update fails to download an update.

Then hit Ctrl-C to stop the capture.

You can now use "tcpdump -r ftppackets.pcap" to view the packets in the file.

Or better yet scp the file to your own pc and use ethereal to view the packets.

Look through the ftp packets for any possible the errors that the sensor may not be reporting.

(NOTE: The sensor is designed to detect most known errors, but there may be an error that the sensor is not correctly detecting).

You can also send me the ftppacket.pcap file if you would like me to look at the output.